As described in Patent Literature 1, for example, when managing a computer system, an incident (event), which constitutes a cause, is detected from among multiple failures or the symptoms thereof detected in the system. Specifically, Patent Literature 1 discloses technology, which uses management software, treats a performance value that exceeds a threshold in a management-target apparatus as the occurrence of an event, and stores event occurrence information in an event DB (database). The management software has an analysis engine for analyzing a causal relationship between multiple events, which have occurred in the management-target apparatus. The analysis engine accesses a configuration DB having management-target apparatus inventory information, recognizes a component within a piece of equipment, which is on the path of an I/O (Input/Output) route, and recognizes components capable of affecting the performance of a logical volume on a host as a group called a “topology”. Then, the analysis engine applies an analysis rule comprising a predetermined condition statement and an analysis result to each topology when an event occurs, and constructs an expanded rule. The expanded rule includes a conclusion event, which could be the root cause, and, in a case where the conclusion event has occurred, a condition event group, which is produced thereby. Specifically, the event described in the THEN part of the rule is the conclusion event, which could be the root cause, and the event described in the IF part of the rule is the condition event.